Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup OCSP stapling on Nginx because I ran a test and it suggested the idea and well, you know.

https://sslcheck.globalsign.com/en_GB/sslcheck?host=aj2jewellers.co.uk#176.58.103.165

I'm getting the error:

nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate

Here's the relevant bits of my .conf

server {
# use Google's DNS
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;

ssl_stapling on;
ssl_stapling_verify on;
## verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /pathtossl/www.aj2jewellers.co.uk.crt;
}
share|improve this question

migrated from webmasters.stackexchange.com Jan 14 at 12:01

This question came from our site for pro webmasters.

    
This is a question I would ask whoever provided the SSL certificate. –  Michael Hampton Mar 10 at 15:11

1 Answer 1

up vote 2 down vote accepted

The ssl_trusted_certificate option should point to the root certificate and all intermediate certificates of the CA, not your signed certificate. This is made clear in the NGINX documentation here http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling_verify. For additional configuration examples, see https://blog.kempkens.io/posts/ocsp-stapling-with-nginx/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.